From deba02c21463ffb8c81ab13fa946b94fec0f3105 Mon Sep 17 00:00:00 2001 From: Rahul Devikar Date: Mon, 9 Feb 2026 20:28:26 -0800 Subject: [PATCH 1/3] Add security workflows: pre-commit hooks, dependency review, CodeQL for C#, Python, and JS/TS --- .github/workflows/codeql.yml | 98 +++++++++++++++++++++++++ .github/workflows/dependency-review.yml | 24 ++++++ .pre-commit-config.yaml | 49 +++++++++++++ 3 files changed, 171 insertions(+) create mode 100644 .github/workflows/codeql.yml create mode 100644 .github/workflows/dependency-review.yml create mode 100644 .pre-commit-config.yaml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000..83a6df0e --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,98 @@ +# CodeQL Analysis for multiple languages +name: CodeQL + +on: + push: + branches: [main] + pull_request: + branches: [main] + schedule: + # Run every Monday at 9:00 AM UTC + - cron: '0 9 * * 1' + +permissions: + actions: read + contents: read + security-events: write + +jobs: + analyze-csharp: + name: Analyze C# + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Setup .NET + uses: actions/setup-dotnet@v4 + with: + dotnet-version: '8.0.x' + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: csharp + queries: +security-extended,security-and-quality + + - name: Autobuild + uses: github/codeql-action/autobuild@v3 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:csharp" + + analyze-python: + name: Analyze Python + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Setup Python + uses: actions/setup-python@v5 + with: + python-version: '3.11' + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: python + queries: +security-extended,security-and-quality + + - name: Autobuild + uses: github/codeql-action/autobuild@v3 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:python" + + analyze-javascript: + name: Analyze JavaScript/TypeScript + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: '20' + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: javascript-typescript + queries: +security-extended,security-and-quality + + - name: Autobuild + uses: github/codeql-action/autobuild@v3 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:javascript-typescript" diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 00000000..9ae691e4 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,24 @@ +# Dependency Review - blocks PRs that introduce known-vulnerable dependencies +name: Dependency Review + +on: + pull_request: + branches: [main] + +permissions: + contents: read + pull-requests: write + +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Dependency Review + uses: actions/dependency-review-action@v4 + with: + fail-on-severity: high + comment-summary-in-pr: always + deny-licenses: GPL-3.0, AGPL-3.0 diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 00000000..6f67ea0d --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,49 @@ +# Pre-commit hooks for Agent365-Samples +# Install: pip install pre-commit && pre-commit install +# Run manually: pre-commit run --all-files + +repos: + # Gitleaks - detect secrets in code + - repo: https://github.com/gitleaks/gitleaks + rev: v8.18.4 + hooks: + - id: gitleaks + + # Whitespace fixes + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.6.0 + hooks: + - id: trailing-whitespace + args: [--markdown-linebreak-ext=md] + - id: end-of-file-fixer + - id: mixed-line-ending + args: [--fix=lf] + - id: check-merge-conflict + - id: check-yaml + args: [--allow-multiple-documents] + - id: check-json + - id: check-toml + - id: check-xml + + # Python specific + - repo: https://github.com/psf/black + rev: 24.4.2 + hooks: + - id: black + language_version: python3 + files: ^python/ + + - repo: https://github.com/pycqa/flake8 + rev: 7.0.0 + hooks: + - id: flake8 + args: [--max-line-length=120] + files: ^python/ + + # Node.js/TypeScript specific + - repo: https://github.com/pre-commit/mirrors-prettier + rev: v4.0.0-alpha.8 + hooks: + - id: prettier + types_or: [javascript, typescript, json] + files: ^nodejs/ From fe63972f6f6187dd9f2bf9ab3047137adc497604 Mon Sep 17 00:00:00 2001 From: Rahul Devikar Date: Mon, 9 Feb 2026 21:13:54 -0800 Subject: [PATCH 2/3] Add security workflows: pre-commit hooks, dependency review --- .github/workflows/codeql.yml | 98 ------------------------------------ 1 file changed, 98 deletions(-) delete mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index 83a6df0e..00000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,98 +0,0 @@ -# CodeQL Analysis for multiple languages -name: CodeQL - -on: - push: - branches: [main] - pull_request: - branches: [main] - schedule: - # Run every Monday at 9:00 AM UTC - - cron: '0 9 * * 1' - -permissions: - actions: read - contents: read - security-events: write - -jobs: - analyze-csharp: - name: Analyze C# - runs-on: ubuntu-latest - - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Setup .NET - uses: actions/setup-dotnet@v4 - with: - dotnet-version: '8.0.x' - - - name: Initialize CodeQL - uses: github/codeql-action/init@v3 - with: - languages: csharp - queries: +security-extended,security-and-quality - - - name: Autobuild - uses: github/codeql-action/autobuild@v3 - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 - with: - category: "/language:csharp" - - analyze-python: - name: Analyze Python - runs-on: ubuntu-latest - - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Setup Python - uses: actions/setup-python@v5 - with: - python-version: '3.11' - - - name: Initialize CodeQL - uses: github/codeql-action/init@v3 - with: - languages: python - queries: +security-extended,security-and-quality - - - name: Autobuild - uses: github/codeql-action/autobuild@v3 - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 - with: - category: "/language:python" - - analyze-javascript: - name: Analyze JavaScript/TypeScript - runs-on: ubuntu-latest - - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Setup Node.js - uses: actions/setup-node@v4 - with: - node-version: '20' - - - name: Initialize CodeQL - uses: github/codeql-action/init@v3 - with: - languages: javascript-typescript - queries: +security-extended,security-and-quality - - - name: Autobuild - uses: github/codeql-action/autobuild@v3 - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 - with: - category: "/language:javascript-typescript" From 1579aba9c29728b89c6018e91dbe5d6e8883227b Mon Sep 17 00:00:00 2001 From: Rahul Devikar Date: Mon, 9 Feb 2026 21:35:35 -0800 Subject: [PATCH 3/3] Fix SPDX license identifiers and use Ruff for Python --- .github/workflows/dependency-review.yml | 2 +- .pre-commit-config.yaml | 17 ++++++----------- 2 files changed, 7 insertions(+), 12 deletions(-) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 9ae691e4..ab3c5558 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -21,4 +21,4 @@ jobs: with: fail-on-severity: high comment-summary-in-pr: always - deny-licenses: GPL-3.0, AGPL-3.0 + deny-licenses: GPL-3.0-only, AGPL-3.0-only diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 6f67ea0d..ac1303a1 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -25,19 +25,14 @@ repos: - id: check-toml - id: check-xml - # Python specific - - repo: https://github.com/psf/black - rev: 24.4.2 + # Python specific - using Ruff + - repo: https://github.com/astral-sh/ruff-pre-commit + rev: v0.4.4 hooks: - - id: black - language_version: python3 + - id: ruff + args: [--fix] files: ^python/ - - - repo: https://github.com/pycqa/flake8 - rev: 7.0.0 - hooks: - - id: flake8 - args: [--max-line-length=120] + - id: ruff-format files: ^python/ # Node.js/TypeScript specific